061d09e034
CI / No Debug Code (pull_request) Successful in 3s
CI / Tests (PHP 8.1) (pull_request) Successful in 49s
CI / Coding Standards (pull_request) Successful in 55s
CI / PHPStan (pull_request) Successful in 1m7s
CI / Tests (PHP 8.3) (pull_request) Successful in 1m41s
CI / Tests (PHP 8.2) (pull_request) Successful in 44s
CI / Build Plugin Zip (pull_request) Has been skipped
Security fixes from a pen-test review (issues #31–#37): - #31 Booking no longer trusts a client-supplied offering_id: a slot-tied offering is authoritative and any offering used must belong to the slot's instructor, closing a free/misrouted-payment bypass. - #34 Availability slot creation rejects an offering the instructor does not own (AvailabilityEndpoint now takes OfferingRepository). - #32 Offering/question/policy listing endpoints now require book_lesson instead of being public (no anonymous consumer exists); Offering::toArray also omits etransfer_email from listings as defense-in-depth. - #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a lesson is inserted, preventing a double-booking race. - #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only creates lessons for slots it actually claimed. - #36 Stripe secret/webhook keys are write-only in the settings UI and a blank submit keeps the stored value; secrets are never echoed back into HTML. - #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at registration and surfaced on the admin invites list. Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200), lint, and cs all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
94 lines
5.2 KiB
PHP
94 lines
5.2 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
if (! defined('ABSPATH')) {
|
|
exit;
|
|
}
|
|
|
|
/**
|
|
* @var string $publishableKey
|
|
* @var bool $secretKeySet
|
|
* @var bool $webhookSecretSet
|
|
* @var string $webhookUrl
|
|
* @var string $mode
|
|
* @var string $currency
|
|
* @var string $etransferEmail
|
|
* @var float $hstRate
|
|
* @var bool $stripeConfigured
|
|
*/
|
|
?>
|
|
<div class="wrap">
|
|
<h1><?php esc_html_e('Studio Settings', 'unsupervised-schedular'); ?></h1>
|
|
|
|
<div class="notice notice-info inline">
|
|
<p>
|
|
<?php if ($stripeConfigured) : ?>
|
|
<?php esc_html_e('Stripe is configured — new registrations default to credit-card billing.', 'unsupervised-schedular'); ?>
|
|
<?php else : ?>
|
|
<?php esc_html_e('Stripe is not configured — new registrations default to e-transfer, which a studio admin marks paid on receipt. Add your Stripe keys below to enable card billing.', 'unsupervised-schedular'); ?>
|
|
<?php endif; ?>
|
|
</p>
|
|
</div>
|
|
|
|
<h2><?php esc_html_e('Stripe', 'unsupervised-schedular'); ?></h2>
|
|
<form method="post">
|
|
<?php wp_nonce_field('usc_settings_action'); ?>
|
|
<input type="hidden" name="usc_action" value="save">
|
|
<table class="form-table">
|
|
<tr>
|
|
<th><label for="publishable_key"><?php esc_html_e('Publishable key', 'unsupervised-schedular'); ?></label></th>
|
|
<td><input type="text" name="publishable_key" id="publishable_key" class="regular-text" value="<?php echo esc_attr($publishableKey); ?>" autocomplete="off"></td>
|
|
</tr>
|
|
<tr>
|
|
<th><label for="secret_key"><?php esc_html_e('Secret key', 'unsupervised-schedular'); ?></label></th>
|
|
<td>
|
|
<input type="password" name="secret_key" id="secret_key" class="regular-text" value="" autocomplete="off" placeholder="<?php echo esc_attr($secretKeySet ? esc_html__('Saved — leave blank to keep', 'unsupervised-schedular') : ''); ?>">
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<th><label for="webhook_secret"><?php esc_html_e('Webhook signing secret', 'unsupervised-schedular'); ?></label></th>
|
|
<td>
|
|
<input type="password" name="webhook_secret" id="webhook_secret" class="regular-text" value="" autocomplete="off" placeholder="<?php echo esc_attr($webhookSecretSet ? esc_html__('Saved — leave blank to keep', 'unsupervised-schedular') : ''); ?>">
|
|
<p class="description">
|
|
<?php esc_html_e('In the Stripe Dashboard, add a webhook endpoint for the payment_intent.succeeded and payment_intent.payment_failed events pointing at:', 'unsupervised-schedular'); ?><br>
|
|
<code><?php echo esc_html($webhookUrl); ?></code><br>
|
|
<?php esc_html_e('then paste its signing secret (whsec_…) here. Card payments are only marked paid once Stripe confirms them via this webhook.', 'unsupervised-schedular'); ?>
|
|
</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<th><label for="mode"><?php esc_html_e('Mode', 'unsupervised-schedular'); ?></label></th>
|
|
<td>
|
|
<select name="mode" id="mode">
|
|
<option value="test" <?php selected($mode, 'test'); ?>><?php esc_html_e('Test', 'unsupervised-schedular'); ?></option>
|
|
<option value="live" <?php selected($mode, 'live'); ?>><?php esc_html_e('Live', 'unsupervised-schedular'); ?></option>
|
|
</select>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<th><label for="currency"><?php esc_html_e('Default currency', 'unsupervised-schedular'); ?></label></th>
|
|
<td><input type="text" name="currency" id="currency" class="small-text" maxlength="3" value="<?php echo esc_attr($currency); ?>"></td>
|
|
</tr>
|
|
<tr>
|
|
<th><label for="hst_rate"><?php esc_html_e('Default HST rate (%)', 'unsupervised-schedular'); ?></label></th>
|
|
<td>
|
|
<input type="number" name="hst_rate" id="hst_rate" class="small-text" min="0" max="100" step="0.01" value="<?php echo esc_attr(number_format($hstRate, 2)); ?>">
|
|
<p class="description"><?php esc_html_e('Added to the subtotal when billing. 0 means no tax. Overridable per booking on My Lessons.', 'unsupervised-schedular'); ?></p>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h2><?php esc_html_e('E-transfer', 'unsupervised-schedular'); ?></h2>
|
|
<table class="form-table">
|
|
<tr>
|
|
<th><label for="etransfer_email"><?php esc_html_e('Default e-transfer email', 'unsupervised-schedular'); ?></label></th>
|
|
<td>
|
|
<input type="email" name="etransfer_email" id="etransfer_email" class="regular-text" value="<?php echo esc_attr($etransferEmail); ?>">
|
|
<p class="description"><?php esc_html_e('Where students send e-transfers, unless an offering overrides it. Instructors can also override per offering or per booking.', 'unsupervised-schedular'); ?></p>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
<?php submit_button(esc_html__('Save Settings', 'unsupervised-schedular')); ?>
|
|
</form>
|
|
</div>
|